“Once risks are identified, they must be assessed in terms of their likelihood and potential impact. This allows the company to prioritize risks and allocate resources accordingly.”